CriticalPublic exploit

RCE in Elasticsearch <1.6.1 via Transport Protocol

IdentifiersCVE-2015-5377CWE-94

CVE-2015-5377 is a remote code execution vulnerability in Elasticsearch versions prior to 1.6.1. The flaw allows remote attackers to execute arbitrary code on the affected system via unspecified vectors involving the transport protocol. This vulnerability has been widely exploited in the wild, particularly for the deployment of Linux-based DDoS botnets.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code with the privileges of the Elasticsearch process. In practice, this has enabled attackers to compromise servers, install persistent malware, and conscript them into botnets used for DDoS attacks. If Elasticsearch is running as root, the compromise is persistent across reboots and can lead to full system compromise.

Mitigation

If you can’t patch tonight, do this now.

If immediate upgrade is not possible, restrict access to the Elasticsearch transport protocol port (9300/tcp) using firewalls or network ACLs to trusted hosts only. Run Elasticsearch as a non-root user to limit the impact of exploitation. Monitor for signs of compromise, such as unexpected outbound connections or traffic spikes indicative of DDoS botnet activity.

Remediation

Patch, then assume compromise.

Upgrade Elasticsearch to version 1.6.1 or later, which addresses this vulnerability. Ensure that all nodes in the cluster are updated. Review and restrict network access to Elasticsearch nodes, especially the transport protocol port (default 9300).

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

CVE-2015-5377MaturityOperationalVerified exploit

This repository contains a Python exploit script (CVE-2015-5377.py) targeting Elasticsearch 1.5.2, which is vulnerable to remote code execution via insecure Java deserialization on the transport protocol (port 9300). The exploit works by first retrieving the cluster name from the Elasticsearch HTTP API (port 9200), then spawning a fake Elasticsearch node (server) and sending a specially crafted 'zenping' UDP packet to the target. The main attack is performed by sending a malicious serialized Java object over TCP port 9300, exploiting the Groovy MethodClosure deserialization chain to execute an arbitrary command on the server. The script requires the attacker to specify the target IP, their own IP, and the command to execute. The README.md provides a brief description of the vulnerability and the attack vector. No detection scripts or fake code are present; the repository is a functional exploit for CVE-2015-5377.

fi3roDisclosed Dec 28, 2020pythonnetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

ElasticElasticsearchapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

elastic security labsNews

Jul 16, 2015

Elasticsearch remote code execution CVE-2015-5377

A remote code execution vulnerability in the Elasticsearch transport protocol affecting versions prior to 1.6.1, exploitable even when Groovy dynamic scripting is disabled.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity